CVE-2026-46746

Name of the Vulnerable Software and Affected Versions SINEC INS versions prior to V1.0 SP2 Update 6

Description The application fails to properly sanitize user input at the '/api/sftp/uploadFiles' endpoint. This allows an authenticated remote attacker to inject shell command payloads through crafted directory names. These payloads are stored and subsequently executed when directory listings are retrieved, enabling the execution of arbitrary commands on the underlying operating system with the privileges of the sinecins service user.

Recommendations Update to version V1.0 SP2 Update 6 or later. As a temporary mitigation, restrict access to the '/api/sftp/uploadFiles' endpoint.